Skip to content

Commit cf4d614

Browse files
authored
Merge pull request #290 from kernelwernel/dev
PCI technique
2 parents c0a31f5 + 9009c83 commit cf4d614

File tree

4 files changed

+59
-2
lines changed

4 files changed

+59
-2
lines changed

auxiliary/add_technique.py

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,14 @@ def write_header(options):
247247
technique_details.append("@link " + options.link)
248248

249249
technique_details.append("@category " + category_str)
250-
technique_details.append("@note " + options.notes)
250+
251+
if options.notes != "":
252+
technique_details.append("@note " + options.notes)
253+
251254
if options.is_gpl:
252255
technique_details.append("@copyright GPL-3.0")
256+
257+
technique_details.append("@implements VM::" + options.enum_name)
253258

254259
# modify the technique details prefix comments
255260
# depending on whether it's GPL or not
@@ -317,7 +322,7 @@ def write_header(options):
317322
str(options.score) +
318323
", VM::" +
319324
options.function_name +
320-
", false } },\n"
325+
" } },\n"
321326
)
322327
update_count += 1
323328

docs/documentation.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -516,6 +516,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
516516
| `VM::UNKNOWN_MANUFACTURER` | Check if the CPU manufacturer is not known | | 50% | | | | |
517517
| `VM::OSXSAVE` | Check if running xgetbv in the XCR0 extended feature register triggers an exception | Windows | 50% | | | | |
518518
| `VM::NSJAIL_PID` | Check if process status matches with nsjail patterns with PID anomalies | Linux | 75% | | | | |
519+
| `VM::PCI_VM` | Check for PCIe bridge names for known VM keywords and brands | Linux | 100% | | | | |
519520
<!-- ADD TECHNIQUE DETAILS HERE -->
520521

521522
<br>

src/cli.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,7 @@ bool is_unsupported(VM::enum_flags flag) {
389389
case VM::FILE_ACCESS_HISTORY:
390390
case VM::UNKNOWN_MANUFACTURER:
391391
case VM::NSJAIL_PID:
392+
case VM::PCI_VM:
392393
// ADD LINUX FLAG
393394
return false;
394395
default: return true;
@@ -996,6 +997,7 @@ void general() {
996997
checker(VM::UNKNOWN_MANUFACTURER, "unknown manufacturer ids");
997998
checker(VM::OSXSAVE, "xgetbv");
998999
checker(VM::NSJAIL_PID, "nsjail PID");
1000+
checker(VM::PCI_VM, "PCIe bridge ports");
9991001
// ADD NEW TECHNIQUE CHECKER HERE
10001002

10011003
std::printf("\n");

src/vmaware.hpp

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -577,6 +577,7 @@ struct VM {
577577
UNKNOWN_MANUFACTURER,
578578
OSXSAVE,
579579
NSJAIL_PID,
580+
PCI_VM,
580581
// ADD NEW TECHNIQUE ENUM NAME HERE
581582

582583
// start of settings technique flags (THE ORDERING IS VERY SPECIFIC HERE AND MIGHT BREAK SOMETHING IF RE-ORDERED)
@@ -10205,6 +10206,52 @@ struct VM {
1020510206
#endif
1020610207
}
1020710208

10209+
10210+
/**
10211+
* @brief Check for PCIe bridge names for known VM keywords and brands
10212+
* @category Linux
10213+
* @implements VM::PCI_VM
10214+
*/
10215+
[[nodiscard]] static bool lspci() {
10216+
#if (!LINUX)
10217+
return false;
10218+
#else
10219+
if (!(
10220+
(util::exists("/usr/bin/lspci")) ||
10221+
(util::exists("/bin/lspci")) ||
10222+
(util::exists("/usr/sbin/lspci"))
10223+
)) {
10224+
debug("PCI_VM: ", "binary doesn't exist");
10225+
return false;
10226+
}
10227+
10228+
const std::unique_ptr<std::string> result = util::sys_result("lspci 2>&1");
10229+
10230+
if (result == nullptr) {
10231+
debug("PCI_VM: ", "invalid stdout output from lspci");
10232+
return false;
10233+
}
10234+
10235+
const std::string full_command = *result;
10236+
10237+
auto pci_finder = [&](const char* str) -> bool {
10238+
if (util::find(full_command, str)) {
10239+
debug("PCI_VM: found ", str);
10240+
return true;
10241+
} else {
10242+
return false;
10243+
}
10244+
};
10245+
10246+
if (pci_finder("QEMU PCIe Root port")) { return core::add(brands::QEMU); }
10247+
if (pci_finder("QEMU XHCI Host Controller")) { return core::add(brands::QEMU); }
10248+
if (pci_finder("QXL paravirtual graphic card")) { return core::add(brands::QEMU); }
10249+
if (pci_finder("Virtio")) { return true; } // could be used by a lot of brands, who knows
10250+
10251+
return false;
10252+
#endif
10253+
}
10254+
1020810255
// ADD NEW TECHNIQUE FUNCTION HERE
1020910256

1021010257

@@ -11226,6 +11273,7 @@ struct VM {
1122611273
case UNKNOWN_MANUFACTURER: return "UNKNOWN_MANUFACTURER";
1122711274
case OSXSAVE: return "OSXSAVE";
1122811275
case NSJAIL_PID: return "NSJAIL_PID";
11276+
case PCI_VM: return "PCI_VM";
1122911277
// ADD NEW CASE HERE FOR NEW TECHNIQUE
1123011278
default: return "Unknown flag";
1123111279
}
@@ -11813,6 +11861,7 @@ std::pair<VM::enum_flags, VM::core::technique> VM::core::technique_list[] = {
1181311861
{ VM::UNKNOWN_MANUFACTURER, { 50, VM::unknown_manufacturer } },
1181411862
{ VM::OSXSAVE, { 50, VM::osxsave } },
1181511863
{ VM::NSJAIL_PID, { 75, VM::nsjail_proc_id } },
11864+
{ VM::PCI_VM, { 100, VM::lspci } },
1181611865
// ADD NEW TECHNIQUE STRUCTURE HERE
1181711866
};
1181811867

0 commit comments

Comments
 (0)